• Who We Are
    • Diversity, Equity & Inclusion
    • Davis Graham Women’s Network
    • Community Service
    • Davis Award
    • Environmental, Social & Governance
  • What We Do
  • Our Professionals
  • News & Events
  • Contact Us
  • Alumni
  • Careers
  • Proposed Bill Seeks to Add New Reserve Study Requirements on Developers of HOA Communities

    A new bill introduced in the Colorado legislature seeks to impose new requirements on developers of HOA communities to obtain 30-year reserve studies and make mandatory reserve contributions. House Bill 26-1099[1] (the “Bill”) would apply to new planned communities and condominiums in Colorado under the Colorado Common Interest Ownership Act. If passed and adopted, the Bill would require the developer/declarant of these projects to obtain, at its cost, a reserve study projecting the costs of the maintenance, repair, and replacement of the common elements and shared property of the community for a 30-year period from an unaffiliated, qualified professional with knowledge of industry standards for reserve studies. The study would need to be obtained before the first sale of a unit or lot. The declarant would also be required to update the reserve study after completion of each phase of the community and update or obtain a new reserve study before the declarant transfers control of the community to the association, in each case at the declarant’s cost. Until control of the community is transferred to the association, the declarant would be obligated to deliver a copy of the reserve study to each prospective purchaser of a unit or lot at least 24 hours before such sale.  Finally, when the declarant transfers control to the association, the Bill would require the declarant to pay the association 1.5% of the total amount necessary to fully fund the 30-year reserves estimated by the most recent reserve study, with such amount to be credited to the association’s reserve account.


    [1] https://leg.colorado.gov/bills/HB26-1099

    Caroline Schorsch

    February 11, 2026
    Legal Alerts
  • Colorado Supreme Court Rules Appeals from County Court to Court of Appeals Unconstitutional

    On Monday, the Colorado Supreme Court ruled two state statutes unconstitutional.

    In Hinds v. Foreman, 2026 CO 9, __ P.3d __, the Court considered a single issue: Whether a final judgment granting a special motion to dismiss under the anti-SLAPP (“strategic lawsuit against public participation”) statute may be appealed from a county court directly to the court of appeals. The Court answered “no”: statutes authorizing appeal from county court directly to the court of appeals are unconstitutional.

    The underlying dispute arose when plaintiff Rebeca Hinds sued her neighbor, Corrine Foreman, in county court over statements Foreman made to law enforcement about Hinds. Foreman filed a special motion to dismiss Hinds’ lawsuit, arguing that her statements were protected speech under Colorado’s anti-SLAPP statute. The county court agreed with Foreman and dismissed Hinds’ suit with prejudice. Hinds appealed the dismissal to the Colorado court of appeals, as authorized by a specific provision of the anti-SLAPP statute, section 13‑20‑1101(7), C.R.S. (2025).

    On appeal, a division of the court of appeals flagged the jurisdictional problem. Section 13‑20‑1101(7) states that the court of appeals has jurisdiction over appeals from special motions to dismiss in actions involving constitutional rights pursuant to section 13‑4‑102.2, C.R.S. (2025) (stating the same).

    However, Article VI, Section 17 of the Colorado Constitution—establishing the jurisdiction of county courts—states that “[a]ppellate review by the supreme court or the district courts of every final judgment of the county courts shall be as provided by law.” (Emphases added.) Using a special procedural mechanism, the division sent the question to the Colorado Supreme Court, asking the Court to resolve the tension between the statutes and the Constitution.

    The Court held that the two statutes were unconstitutional. In a unanimous opinion, authored by Justice Maria E. Berkenkotter, the Court explained that the Constitution is the state’s supreme law and that the Constitution limits the power of the General Assembly. When a legislative act conflicts with a provision of the Constitution, the Constitution wins out.

    Here, Article VI, Section 17 of the Constitution provides that a county court’s “final judgment” is appealable only to the district court or the supreme court. (The Court noted that the county court’s dismissal of Hinds’ case with prejudice was a final judgment.) This means statutes authorizing appeal from the county court to the court of appeals directly violate the Constitution and must be declared unconstitutional. Further, a statute may not attempt to “subtract” jurisdiction from another court in violation of the Constitution.

    The Court’s opinion did not strike down the statutes entirely. It noted that the court of appeals may still have jurisdiction over non-final judgments from county courts. The Court suggested that the General Assembly craft a more elegant solution to the question of county court appeals.

    The Court concluded that the division did not have jurisdiction to hear Hinds’ appeal and remanded the case to the division with instructions to dismiss the case. Because Hinds could not reasonably have anticipated that she should have filed her appeal in district court, she will be permitted to re-file her appeal in the district court.

    Caroline Schorsch

    February 6, 2026
    Legal Alerts
  • Fourth Quarter 2025 Asset Management Regulatory Update

    Table of Contents

    • 2026 SEC Examination Priorities
    • FINRA Fines Firm $10 Million for Gifts and Entertainment Violations
    • SEC Fines Dually Registered Firm $325,000 for Cybersecurity and Identity Theft Program Failures
    • SEC Charges Six Advisers for Form ADV Filing Issues
    • RIA Pays $150,000 to Settle Enforcement Action for Ongoing Compliance Failures
    • SEC Delegates Authority to the Director of the Division od Investment Management in Connection With Confidential Information Requests

    2026 SEC EXAMINATION PRIORITIES

    On November 17, 2025, the Securities and Exchange Commission’s (“SEC” or the “Commission”) Division of Examinations (“EXAMS” or the “Division”) published its examination priorities for 2026. Although this discussion will focus on the relevant risks related to registered investment companies (“RICs”) and investment advisers (“IA”), the Commission included areas of focus for broker-dealers (“BD”), self-regulatory organizations, and other market participants.[1] 

    Investment Advisers

    Fiduciary Duty Standards: The SEC will continue to focus on the duties of care and loyalty. As part of this, EXAMS will review investment advice and disclosures relating to:

    • the impact of advisers’ financial conflicts of interest;
    • advisers’ consideration of cost, investment product’s or strategy’s investment objectives, characteristics, liquidity, risks and potential benefits, volatility, likely performance, time horizon, and cost to exit; and
    • advisers seeking best execution with the goal of maximizing value.

    EXAMS will focus on alternative investments (e.g., private credit), complex investments (e.g., leveraged or inverse exchange traded funds (“ETFs”)), products with a higher cost associated with investing, and whether investment recommendations are consistent with product disclosures and the clients’ investment objectives, risk tolerance, and background.

    As part of this process, the Division will pay particular attention to any recommendations made to older investors or products with increased volatility, private fund advisers who also advise separately managed accounts (“SMA”), newly registered funds advisers, newly launched private fund advisers, and advisers who are new to the private fund space. Lastly, EXAMS will focus on types of advisers and advisory services or business practices that may create additional risks and potential or actual conflicts of interest (e.g., dually registered BD/IAs).

    Adviser Compliance Programs: Examinations will include analyzing the advisers’ annual reviews of the effectiveness of their compliance policies and procedures. This will include adherence to fiduciary principles, effectiveness of addressing conflicts of interest, and whether these elements address compliance with the Investment Advisers Act of 1940 (the “Advisers Act”). Areas of focus may include:

    • the implementation and enforcement of policies and procedures;
    • whether disclosures address fee-related conflicts, including conflicts that arise from account and product compensation structures; and
    • advisers who engage with activist activities.

    Never Examined and Recently Registered Advisers: Consistent with prior years, EXAMs will prioritize examinations of these advisers.

    Investment Companies

    RIC exams will generally include their compliance programs, disclosures, filings (e.g., summary prospectus) and governance practices. RIC operations of particular focus include fund fees and expenses (and any associated waivers and reimbursements), and portfolio management practices and disclosures, for consistency with statements about investment strategies or approaches, with fund filings and marketing materials, and if and after the compliance date has gone into effect, the amended rule on Investment Company Names (“Fund Names Rule”)[2].

    EXAMS will also continue to monitor:

    • RICs that participate in mergers or similar transactions, including any associated operational and compliance challenges;
    • certain RICs that use complex strategies and/or have significant holdings of less liquid or illiquid investments (e.g., closed end funds), including any associated issues regarding valuation and conflicts of interest; and
    • RICs with novel strategies or investments, including funds with leverage vulnerabilities.

    Additional Areas of Focus for All Market Participants

    Cybersecurity: Cybersecurity will continue to be a focus during the examination process to prevent any interruption to mission-critical services and investor information. As part of the Division’s review, an emphasis will be placed on registrants’ practices and procedures to assess whether they are reasonably managing information security and operational risks, governance practices, data loss prevention, access controls, account management, incident response, and training adaptations in the wake of the proliferation of artificial intelligence (“AI”).

    Regulation S-ID and Regulation S-P: EXAMS will be assessing compliance with Regulation S-ID with a focus on firms’ development and implementation of a written Identity Theft Prevention Program as well as the reasonableness of their policies in procedures included therein. As it pertains to Regulation S-P, the Division will be inquiring with firms about their progress in firms’ development and implementation of a written Identity Theft Prevention Program. After the compliance date has passed, this will shift to ensuring that firms have developed, implemented, and maintained policies and procedures in accordance with the rule’s provisions.

    Emerging Financial Technology: The Division intends to focus on firms that engage in the use of certain emerging financial technology products and services, such as automated investment advisory services, recommendations, and related tools and methods. During these reviews, EXAMS will be assessing the following: (1) representations are fair and accurate; (2) operations and controls in place are consistent with disclosures made to investors; (3) algorithms lead to advice or recommendations consistent with investors’ investment profiles or stated strategies; and (4) controls to confirm that advice or recommendations resulting from automated tools are consistent with regulatory obligations to investors, including retail and older investors. With respect to AI, the Division will review the accuracy of firms’ AI representations and capabilities, whether adequate policies and procedures have been instituted, and the integration of regulatory technology to automate internal processes.

    Regulation Systems Compliance and Integrity: Reviews of systems compliance and integrity (“SCI”) will focus on incident response policies and procedures and their effectiveness as well as SCI entities’ management of third-party vendor risk and identification of SCI vendor systems.

    Anti-Money Laundering: Lastly, for RICs that are required to establish anti-money laundering (“AML”) programs under the Bank Secrecy Act, the Division will be assessing whether their AML program is: (1) appropriately tailored and updated, including accounting for risks associated with omnibus accounts maintained for foreign financial institutions; (2) adequately conducting independent testing; (3) establishing an adequate customer identification program, including for beneficial owners of legal entity customers; (4) meeting their Suspicious Activity Report (“SAR”) filing obligations; and (5) monitoring the Department of Treasury’s Office of Foreign Assets Control (“OFAC”) sanctions and ensuring compliance with such sanctions.

    FINRA FINES FIRM $10 MILLION FOR GIFTS AND ENTERTAINMENT VIOLATIONS

    On November 3, 2025, the Financial Industry Regulatory Authority (“FINRA”) announced that it had fined a wholesale distributor of securities (the “Firm”) $10 million and censured the Firm for: (i) providing excessive non-cash compensation to representatives of broker-dealer clients in connection with the distribution of the Firm’s investment company securities; (ii) falsifying expense records, (iii) misleading reporting to client firms, and (iv)  supervisory failures that occurred from at least 2018 through February 2024 (the “Relevant Period”). Without admitting or denying fault, the Firm consented to FINRA’s findings, agreed that within 12 months a senior member who is a registered principal of the Firm will certify that it has implemented a supervisory system, and to provide annual compliance certifications for three years regarding its controls over non-cash compensation and related recordkeeping.

    The Letter of Acceptance detailed FINRA’s findings, including findings that the Firm’s wholesalers provided gifts and entertainment that exceeded FINRA’s non-cash compensation limit under Rule 2341, as well as instances where wholesalers offered entertainment, gifts, or payments of educational event expenses that were preconditioned on client firm representatives achieving sales targets with respect to their customers’ purchase of the Firm’s products. For example, the Letter of Acceptance noted instances where courtside seats to professional basketball games were provided to client firm representatives. Because members of the Firm did not also attend the events, FINRA determined that the tickets were gifts instead of business entertainment, making them subject to the limits set forth in Rule 2341 (described below).

    As further detailed in the Letter of Acceptance, FINRA also found that Firm wholesalers created and submitted false expense reports related to more than $650,000 worth of non-cash compensation provided to client firm representatives.

    FINRA noted that certain client firms placed limits on the amount of non-cash compensation that their representatives could receive from wholesaling firms, and had requested that the Firm submit quarterly reports detailing non-cash compensation the Firm provided to the client firm’s representatives. The Letter of Acceptance stated that throughout the Relevant Period, the Firm had submitted quarterly non-cash compensation reports to client firms, in which gifts and entertainment had been underreported.

    Finally, the Letter of Acceptance included that the Firm failed to reasonably supervise its provision and reporting of non-cash compensation. FINRA Rule 3110(a) requires member firms to establish and maintain system to supervise the activities of each associated person that is reasonably designed to comply with applicable securities laws and regulations and FINRA rules. FINRA found that during the Relevant Period, the Firm had policies and procedures in place governing cash and non-cash compensation, but that the Firm’s policies and procedures did not provide guidance as to how to evaluate whether non-cash compensation was too frequent or excessive. FINRA also found that the Firm did not have a reasonable system for supervising the accuracy of expense reports and did not have reasonable controls in place to ensure that modifications to expense reports were appropriate

    FINRA Rule 2341(l) sets forth requirements regarding a firm’s payment of cash and noncash compensation in connection with the sale and distribution of investment company securities. Specifically, FINRA Rule 2341(l)(5) prohibits firms from “accept[ing] or mak[ing] payments or offers of payments of any non-cash compensation,” in excess of $100 per person and that are “not preconditioned on achievement of a sales target”, subject to some de minimis exceptions for occasional events and situations. FINRA’s position is that “a member must accompany or participate in an event for it to be business entertainment.”

    SEC FINES DUALLY REGISTERED FIRM $325,000 FOR CYBERSECURITY AND IDENTITY THEFT PROGRAM FAILURES

    On November 25, 2025, the SEC announced that an Oregon based broker-dealer and investment adviser (the “Adviser”) agreed to settle charges alleged by the SEC that the Adviser failed to maintain reasonably designed policies and procedures concerning cybersecurity, the protection of customer information, and identity theft protection, resulting in a $325,000 civil penalty and censure (the “Order”).

    According to the SEC, from 2019 to 2024, 13 branch offices (“member firms”) of the Adviser experienced breaches to their email accounts, exposing client records and personally identifiable information (“PII”). These breaches occurred in large part at member firms that in the SEC’s view lacked core controls required by the Information Security Policy released by the Adviser in 2020 (the “2020 Policy”)—such as multi-factor authentication, annual security awareness training, and written incident response policies. The Commission further asserted that prior to the release of the 2020 Policy, neither the Adviser nor its member firms had any written policies or procedures governing information security across its distributed branch network.

    Under Rule 30(a) of Regulation S-P[3], every registered broker-dealer and investment adviser must adopt written policies and procedures that are “reasonably designed to (i) ensure the security and confidentiality of customer information; (ii) protect against any anticipated threats or hazards to the security or integrity of customer information; and (iii) protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer.”

    The Commission asserted that the Adviser violated Rule 30(a) for failure to adopt written policies and procedures reasonably designed to protect customer records and information. Additionally, the SEC findings stated that the Adviser violated Rule 201 of Regulation S-ID[4]—the Identity Theft Red Flags Rule—because the Adviser failed to update its Identity Theft Protection Program on a routine basis despite multiple incidents affecting customers, failed to incorporate relevant cyber-related red flags, failed to establish appropriate responses once red flags were detected, and failed to determine whether it offered or maintained covered accounts.

    Without admitting or denying the Commission’s findings, the Adviser agreed to a cease-and-desist order, censure, and $325,000 civil penalty.

    SEC CHARGES SIX ADVISERS FOR FORM ADV FILING ISSUES

    On November 17, 2025, the SEC announced changes against six investment advisory entities alleging material misrepresentations and unsubstantiated statements in Form ADV filings made with the SEC regarding their organizations, office locations, assets under management, and clients.

    Form ADV is the primary disclosure document used by investment advisers, and it requires advisers to report information about their business, ownership, and other information.

    The SEC’s complaint alleged, among other allegations, the following:

    • Certain advisers claimed to manage specifically named private funds, however, the SEC was unable to substantiate these claims.
    • Certain advisers listed office addresses, however, there was no record of the advisers ever operating out of those locations.
    • Certain advisers claimed to be public companies, however, the SEC’s records contain no evidence (filings or registrations) to confirm these claims.

    The six advisers were asked to provide records validating the information provided on Form ADV, and none of the advisers provided sufficient documentation to substantiate the disclosures.

    The SEC alleged violations of (i) Section 204(a) of the Advisers Act for failure to maintain accurate records and (ii) Section 207 of the Advisers Act for making false and misleading statements in SEC filings. The complaints seek both injunctive relief and civil penalties, and the SEC’s investigation is ongoing. 

    This enforcement action reinforces the SEC’s commitment to transparency and accuracy in Form ADV filings made by investment advisers.

    RIA PAYS $150,000 TO SETTLE ENFORCEMENT ACTION FOR ONGOING COMPLIANCE FAILURES

    On November 24, 2025, pursuant to an Order Instituting Administrative Cease-and-Desist Proceedings (the “Order”), a Registered Investment Adviser and its principal (collectively, the “RIA”) agreed to pay civil penalties in the amount of $150,000 to settle the SEC’s enforcement action against the RIA for longstanding compliance failures.

    The Order came after the RIA continued to be noncompliant even following prior SEC enforcement actions in 2004 and SEC deficiency findings in 2005, 2020, and 2021.

    The Order alleged, among other allegations, the following violations:

    • From 2013 through 2020, the RIA failed to perform the required annual review of its compliance policies and procedures to confirm adequacy and effectiveness of implementation.
    • From at least 2013 through February 2025, the RIA claimed (through public filings) to have a tiered fee schedule. However, the RIA actually charged negotiated fees (based on percentage of assets under management) that were often higher than the fees disclosed to clients.
    • The RIA’s compliance policy required that client contracts be maintained for purposes of recordkeeping, however, the RIA failed to maintain executed advisory agreements from a large number of its clients.
    • The RIA did not maintain adequate records of brochure deliveries.

    Based on the above allegations, the SEC found willful violations of Section 206(4) of the Advisers Act and Section 204 of the Advisers Act. As part of the Order, the RIA is required to obtain an independent consultant to, among other things, conduct compliance reviews and make recommendations surrounding the RIA’s areas of noncompliance.

    This enforcement action reinforces the principle that compliance requires ongoing oversight and implementation, rather than a one-time exercise of meeting compliance requirements.

    SEC DELEGATES AUTHORITY TO THE DIRECTOR OF THE DIVISION OF INVESTMENT MANAGEMENT IN CONNECTION WITH CONFIDENTIAL INFORMATION REQUESTS

    On December 29, 2025, the SEC amended Rule 30-5 to delegate authority to the Director of the Division of Investment Management (the “IM Director”) to issue orders granting, denying, or revoking requests for confidential treatment of information in Form ADV and other filings under Section 210(a) of the Advisers Act.

    By way of brief background, Section 210(a) of the Advisers Act generally requires that information contained in registration applications, reports, or amendments filed pursuant to the Advisers Act be made publicly available, unless the SEC determines that public disclosure is neither necessary nor appropriate in the public interest or for the protection of investors. Thus, prior to the amendment, only the SEC could grant, deny, or revoke confidential treatment requests.

    As amended, Rule 30-5(g)(8) grants the IM Director delegated authority to issue orders granting or denying confidential treatment applications under Section 210(a), and to revoke previously issued orders. The SEC retains the right to review any action taken by the IM Director under rule 30-5(g)(8), either on its own initiative or upon petition by a party or intervenor, including applicants for confidential treatment under Section 210(a) of the Advisers Act.

    As noted in the adopting release, the SEC acknowledged it has not historically acted on applications for confidential treatment. With this new delegation to the IM Director, the SEC appears to be establishing a formal process for advisers seeking confidential treatment.

    UPCOMING CONFERENCES

    2026
    DateHost*EventLocation
    1/26MFDF2026 Directors’ InstituteNaples, FL
    2/3-5ICI/IDC2026 ICI InnovateHouston, TX
    2/9MFDFETF Share Class Exemptive Relief and Board OversightWebinar
    2/10MFDFDirector Discussion Series – Open ForumMiami, FL
    3/5MFDF2026 Fund Governance & Regulatory Insights ConferenceWashington, DC
    3/22-25ICI/IDCInvestment Management ConferencePalm Desert, CA
    4/8MFDFMPI’s Annual Survey of Investment Firm Profitability and Economies of ScaleWebinar
    4/8-9ICI/IDCFoundations for Fund Directors®Washington, DC
    4/14MFDFDirector Discussion Series – Open ForumCharlotte, NC
    4/16MFDFDirector Discussion Series – Open Forum (Kansas City)Kansas City, MO
    4/29 – 5/1ICI/IDCLeadership SummitWashington, DC
    4/29 – 5/1ICI/IDCFund Directors WorkshopWashington, DC
    5/13MFDFUpdate on Fund Industry Claims Trends: An Insurer’s PerspectiveWebinar
    5/21MFDFMutual Fund Director Compensation: The MPI Annual SurveyWebinar
    6/4MFDF2026 Conference of Fund Leaders RoundtableChicago, IL
    6/8-10ICI/IDCETF ConferenceNashville, TN
    9/27-30ICI/IDCTax and Accounting ConferenceMarco Island, FL
    10/26-28ICI/IDCFund Directors ConferenceScottsdale, AZ
    11/10ICI/IDC2026 Retail Alternatives and Closed-End Funds ConferenceNew York, NY
    2027
    DateHost*EventLocation
    2/1MFDF2027 Directors’ InstituteAmelia Island, FL
    4/8MFDF2027 Fund Governance & Regulatory Insights ConferenceWashington, DC
    3/14-17ICI/IDCInvestment Management ConferenceSan Diego, CA
    5/10-12ICI/IDCLeadership SummitWashington, DC
    5/10-12ICI/IDCFund Directors Workshop (IDC)Washington, DC
    9/19-22ICI/IDCTax and Accounting ConferencePhoenix, AZ
    10/25-27ICI/IDCFund Directors ConferenceScottsdale, AZ
    11/9ICI/IDCRetail Alternatives and Closed-End Funds ConferenceNew York, NY

    *Host Organization Key: Mutual Fund Directors Forum (“MFDF”), Independent Directors Council (“IDC”), and Investment Company Institute (“ICI”)


    © 2026, Davis Graham & Stubbs LLP. All rights reserved. This newsletter does not constitute legal advice. The views expressed in this newsletter are the views of the authors and not necessarily the views of the firm. Please consult with your legal counsel for specific advice and/or information.


    [2] Sec. and Exch. Comm’n, Final Rule: Investment Company Names, Release No. IC-35000 (Sept. 20, 2023).

    [3] 17 C.F.R. § 248.30(a).

    [1] The SEC’s 2026 examination priorities can be found at https://www.sec.gov/files/2026-exam-priorities.pdf.

    [4] 17 C.F.R. § 248.201.


    CONTACT US
    Peter H. Schwartz
    Alena Prokop
    Stephanie Danner
    Martine Ventello
    Mackenzie Coupens
    Robert Hill

    Caroline Schorsch

    January 20, 2026
    Legal Alerts
  • SEC Extends Section 16 Reporting to Directors & Officers of Foreign Private Issuers

    The Holding Foreign Insiders Accountable Act, as part of the 2026 National Defense Authorization Act (the “NDAA”) that was signed into law on December 18, 2025, introduces a new compliance requirement that will, for the first time, subject directors and certain officers of foreign private issuers (“FPIs”) to the beneficial ownership reporting of Section 16(a) and, possibly, short-swing profit provisions of Section 16(b) of the Securities Exchange Act of 1934. This rule change represents a significant shift in compliance expectations for FPIs and aligns the insider reporting regime for FPIs with that applicable to U.S. domestic issuers.

    Background

    Section 16 of the Exchange Act has long required directors, certain officers, and 10% shareholders (collectively, “insiders”) of U.S. public companies to publicly disclose transactions in company securities and disgorge certain short-swing profits resulting from those transactions. Federal legislation passed in December 2025 directed the Securities and Exchange Commission (the “SEC”) to extend these obligations to insiders of FPIs. As a result, covered directors and officers of FPIs will be required to file Forms 3, 4, and 5 electronically with the SEC and will be subject to potential disgorgement obligations. The new requirements are expected to take effect on March 18, 2026.

    FPIs and their insiders should begin preparing governance, compliance, and operational processes now to avoid late filings, preserve Rule 16b exemptions, and reduce disgorgement and litigation risk.

    Who Will Be Covered Under the Section 16(a) Amendments

    Covered Issuers

    FPIs with a class of equity securities registered under Section 12 of the Exchange Act are covered under the amendments to Section 16(a). Issuers furnishing reports under the Multijurisdictional Disclosure System or otherwise qualifying as FPIs are not excluded solely by virtue of that status.

    Covered Insiders

    The following persons of an FPI will be subject to Section 16:

    • each director of the FPI (directors serving on several public company boards must report for each); and
    • each “officer” of the FPI (as defined by the Exchange Act, including the issuer’s president, principal financial and accounting officers, principal operating officer, any vice president in charge of a principal business unit, division, or function, and any other person who performs similar policy-making functions).

    Section 16(a) also applies to holders of more than 10% of a registered class of equity securities (“10% holders”) of a domestic issuer. While the NDAA specifically refers only to “officers and directors” of FPIs, it is unclear if the SEC will elect to extend the applicability of Section 16(a) to 10% holders of FPIs. If so, the Section 13(d) “group” principles may apply in determining who is a 10% holder.

    Interplay With FPI Status & Home-Country Practices

    The new regime does not provide a broad exemption based on home-country practice. Issuers may maintain home-country governance accommodations in other areas, but Section 16(a)’s reporting rules (and possibly Section 16(b)’s short-swing profit rules as discussed below) will apply to covered FPIs and their insiders as a matter of U.S. federal law. Insiders must consolidate reporting across all transactions in the issuer’s registered class or classes of securities, whether executed in the U.S. or abroad. Broker instructions and pre-clearance policies should be harmonized across trading venues.

    What Must Be Reported and When Under Section 16(a)

    Form Types & Deadlines
    • Initial statement of beneficial ownership (Form 3). Each covered insider must file a Form 3 disclosing all equity securities of the FPI beneficially owned by such insider (whether directly or indirectly held) within 10 calendar days of first becoming an insider of the FPI.
    • Changes in beneficial ownership (Form 4). Most subsequent transactions must be reported on Form 4 within two business days after the trade’s execution date. Reportable events typically include open-market purchases and sales, grants, exercises, and conversions of options and other derivatives, and acquisitions under equity compensation plans. The two-business-day deadline is strict and applies to virtually all changes in ownership, regardless of transaction size or the market where the trade occurred. FPIs with trading on non-U.S. exchanges must map local execution times to U.S. business days and calendar conventions to determine Form 4 deadlines accurately.
    • Annual statement (Form 5). Transactions eligible for deferred reporting—such as bona fide gifts—and any reportable transactions inadvertently omitted from Form 4, must be reported on Form 5 within 45 days after the issuer’s fiscal year end, if not previously reported.

    Note that in all cases, it is the insider’s legally responsibility to ensure the accurate and timely filing of its forms. However, it is customary for companies to provide centralized assistance with the preparation and filing process for their directors and officers.

    Filing Requirements

    Forms 3, 4, and 5 use standardized transaction codes and require precise disclosure of derivative securities, exercise/conversion mechanics, and the nature of indirect ownership (e.g., through controlled entities, trusts, or family holdings).

    Filings must be in English and filed electronically via the SEC’s EDGAR Next platform. In order to file Forms 3, 4, and 5, each insider must obtain EDGAR Next credentials (central index key (CIK) and associated access codes). Many issuers require insiders to grant a durable power of attorney to internal compliance personnel or outside counsel to ensure timely filings. Accordingly, organizations should complete EDGAR Next account updates to manage user permissions and authorizations prior to the commencement of Section 16 reporting obligations on March 18, 2026.

    Short-Swing Profit Liability & Exemptions Under Section 16(b)

    At the current time, the NDAA purports to only make changes to Section 16(a) (the reporting rules). However, Section 16 has other notable provisions— namely Section 16(b), which provides for strict liability of directors, officers and 10% beneficial of domestic issuers for any “profit” realized from any purchase and sale (or sale and purchase) of the issuer’s equity securities within a six-month period, regardless of intent. Under Section 16(b), if the issuer does not pursue recovery, shareholders may bring derivative actions on its behalf. It is currently unclear if the SEC will interpret the legislation to extend to all of Section 16, or just Section 16(a).

    Should Section 16(b) be deemed applicable to FPIs, pre-clearance requirements in insider trading policies help mitigate the risk of short-swing profit. Additionally, certain transactions are exempt from short-swing profit matching under Rule 16b-3 (e.g., board- or committee-approved grants and certain dispositions to the issuer) and Rule 16b-6 (derivative securities), among others. Options, restricted stock units, performance shares, and other derivative interests are subject to specific reporting and matching rules. Cashless exercises, net settlement, and same-day sales require particular attention. Robust pre-clearance and board-level approval processes help preserve exemptions and reduce litigation risk.

    Transition, Effective Date & Compliance Planning

    The amendments include an effectiveness date and transition mechanics for insiders who become newly subject to Section 16(a). Insiders will need to file an initial Form 3 as of the date they become subject to Section 16 and then comply with the Form 4/Form 5 regime thereafter. Should the rules of Section 16(b) be deemed applicable to FPIs, the SEC will hopefully release guidance regarding the short-swing profit matching under Rule 16b-3 for initial reports.

    IMMEDIATE ACTION ITEMS

    • Identify covered personnel. Titles used in non-U.S. organizations should be mapped to identify all officers who meet the Exchange Act definition of “officer.” Directors and officers of FPIs will likely need to file an initial Form 3 by or promptly following the effective date of the amendments, and then comply with the Form 4/Form 5 rules thereafter.[1]
    • Update related policies and procedures. Review and update insider trading and equity award policies to address Section 16 reporting and short-swing profit rules proactively, including Form 3/4 workflows, blackout calendars, pre-clearance, and standardized documentation supporting Rule 16b-3 approvals.
    • Prepare for initial EDGAR filings. Select a filing agent or system and obtain or confirm EDGAR credentials for all insiders. Consider implementing powers of attorneys and setting internal cut-offs earlier than the two-business-day standard for Form 4 filings.
    • For information regarding the SEC’s new EDGAR Next enrollment process, see our prior alert: COUNTDOWN TO EDGAR NEXT: Compliance Deadline is Rapidly Approaching — Are You Ready?.
    • Train and communicate. Provide targeted training for directors, officers, plan administrators, and brokers on what is reportable, when, and by whom, with special emphasis on time-zone and non-U.S. market executions.

    NEXT STEPS

    For questions about scope of coverage, short-swing profit rules, or how to structure equity awards and insider trading policies under Section 16, contact a member of the Davis Graham Public Companies & Capital Markets Group to help you build a tailored compliance plan and filing protocol.

    • [1] The Section 8103(b)(1)(D) of the NDAA amends Section 16(a) to require FPI officers and directors to file their reports within 90 days of enactment. However, Section 8103(d)(a) requires the SEC to issue final regulations effecting the legislation within 90 days of enactment. It remains unclear if the SEC will interpret the legislation as requiring Form 3s to be due by the effective date of its final regulations or for the 10-day reporting deadline of Form 3 to commence on the effective date.

    Lindsey Reifsnider

    January 11, 2026
    Legal Alerts
    Foreign private issuers, SEC, sec disclosures, Section 16 Reporting
  • Federal and Colorado Action on Data Centers and Large Power Loads

    January 12, 2026

    There has been a recent flurry of regulatory activity in both Washington, D.C. and Colorado as federal and state regulators work to establish new frameworks for data center interconnection and co-located generation. The Secretary of Energy directed FERC to consider an Advanced Notice of Proposed Rulemaking on large load interconnection procedures, FERC issued an order requiring PJM to develop co-location tariff provisions, the Colorado Public Utilities Commission directed Xcel Energy to file large-load tariff principles by January 2026, and FERC rejected Tri-State’s proposed large load tariff on jurisdictional grounds. These developments underscore ongoing efforts to adapt existing frameworks to how utilities and regulators approach data center interconnection, cost allocation, and co-located generation.

    DOE’s Direction to FERC

    On October 23, 2025, Secretary of Energy Chris Wright directed the Federal Energy Regulatory Commission (FERC or Commission) to consider an Advanced Notice of Proposed Rulemaking (ANOPR) addressing interconnection procedures for large loads (defined as those exceeding 20 megawatts (MW)), and requesting that FERC issue a final rule by April 30, 2026. Secretary Wright issued the ANOPR pursuant to Section 403 of the Department of Energy Organization Act, which empowers the Secretary of Energy to propose rules to FERC, but does not require FERC to implement them. Additionally, FERC issued a notice inviting comments regarding the ANOPR on October 27, 2025 in Docket No. RM26-4-000.

    DOE’s proposed ANOPR advances the position that FERC has jurisdiction over large load interconnections through FERC Order No. 888, based on four legal theories:

    • large load interconnections are a critical component of open access transmission service analogous to generator interconnections under FERC Order No. 2003;
    • such interconnections directly affect jurisdictional wholesale rates;
    • the proposal does not intrude on states’ retail electricity jurisdiction; and
    • FERC’s exclusive jurisdiction over transmission of electric energy in interstate commerce encompasses interconnection service.

    The ANOPR enumerates 14 guiding principles, including limiting FERC’s authority to interconnections directly to transmission facilities, applying reforms only to new loads greater than 20 MW, studying load and hybrid facilities alongside generation projects, implementing standardized deposits and withdrawal penalties, and allocating 100% of network upgrade costs to the load.

    Whether FERC has statutory authority to regulate large load interconnections remains uncertain. Any rules promulgated will face scrutiny under the major questions doctrine (West Virginia v. EPA) and review under Loper Bright Enterprises v. Raimondo, which held that courts should not apply Chevron deference to agency interpretations of ambiguous statutes. FERC’s notice inviting comments on the ANOPR was procedural only and did not discuss or endorse the four legal theories noted above. FERC’s own precedent also highlights this ambiguity: in rejecting Tri-State’s large load tariff (discussed below), FERC stated that the proposal may regulate ‘terms and conditions of a Customer’s retail service in ways that are beyond the Commission’s authority.’ Additionally, the National Association of Regulatory Utility Commissioners (NARUC) has urged FERC to substantially modify the ANOPR, asserting it infringes on states’ retail electricity jurisdiction. These challenges create substantial uncertainty as to whether FERC will adopt the ANOPR in whole, in part, or at all.

    FERC’s PJM Co-Location Order

    On December 18, 2025, FERC unanimously issued an order directing PJM Interconnection (PJM) to revise its tariff to address co-located loads at generating facilities. The order arose from FERC’s show cause proceeding following high-profile co-location arrangements, including Amazon’s data center at Talen Energy’s Susquehanna nuclear plant located in Pennsylvania and Microsoft’s Three Mile Island restart agreement.

    FERC found PJM’s existing tariff unjust and unreasonable due to lack of clarity regarding co-located loads. The order requires PJM to offer four transmission service options:

    • traditional Network Integration Transmission Service for entire nameplate load;
    • interim non-firm service permitting expedited construction before grid upgrades are completed, with acceptance of curtailment risk;
    • firm contract demand service for only the portion of load expected to be served by the grid; and
    • non-firm contract demand service (which carries curtailment risk).

    The order directs PJM to propose mechanisms, such as minimum monthly charges, to ensure that costs of maintaining grid reliability and backup capability are appropriately allocated, even for facilities with limited grid usage or rarely used backup service. Final tariff details remain pending PJM’s compliance filings (due in January 2026) and further FERC review.

    While Colorado is not within PJM’s footprint, FERC’s order signals potential federal regulatory approaches to co-location and may inform or influence Colorado’s frameworks. For example, Xcel Energy’s large-load tariff filing due in January 2026 could potentially incorporate concepts from the PJM order.

    Colorado PUC Directive to Xcel Energy

    On November 6, 2025, the Colorado Public Utilities Commission (PUC) issued Decision No. C25-0747 in Proceeding No. 24A-0442E (Xcel’s 2024 Just Transition Solicitation), adopting guiding principles for service to large-load customers and directed Xcel Energy to file a more detailed large-load tariff proposal by January 31, 2026 as part of Xcel’s Just Transition Solicitation Plan proceeding (Proceeding No. 24A-0442E). The PUC-adopted guiding principles include measures such as upfront fees and security deposits, minimum 15-year service contracts, minimum bill requirements for reserved capacity, and early exit fees if the developer terminates service before the contract term.

    Xcel’s forthcoming large-load tariff proposal is expected to address how co-located generation affects cost allocation. This may include differentiated transmission charges that reflect actual grid usage rather than full nameplate capacity for data centers with onsite generation, though minimum charges for maintaining backup grid service could also apply, similar to concepts in FERC’s PJM order.

    Xcel’s formal tariff filing (original deadline January 31, 2026; Xcel filed a variance petition on January 26, 2026, requesting an extension to April 2, 2026) could inform approaches by other Colorado utilities and cooperatives addressing large loads, though structural and governance differences among utilities may limit direct applicability, and the tariff’s terms are expected to materially affect project economics and feasibility for data centers requiring grid-supplied power or backup service.

    Tri-State’s Rejected Large Load Tariff

    In August 2025, Tri-State proposed a High-Impact Load Tariff at FERC (Docket No. ER25-3316) for loads exceeding 45 megawatts. On October 27, 2025, FERC rejected the tariff, determining that provisions requiring member cooperatives’ retail customers to execute agreements and related security deposit requirements exceeded FERC’s jurisdiction over wholesale transactions under Federal Power Act sections 205 and 206. As of this writing, no revised tariff has been proposed.

    FERC’s rejection underscores the jurisdictional tensions evident in DOE’s ANOPR. Developers considering sites in Tri-State member cooperative territories (which include 15 Colorado cooperatives) may want to consider engaging early with both the local distribution cooperative and Tri-State to understand capacity availability and study timelines. Until a revised framework is in place, large load interconnection in Tri-State territories will follow existing procedures.

    Potential Colorado Implications

    These federal and state actions signal several key themes:

    Cost Allocation Based on Actual Use. Both FERC’s PJM order and Colorado’s emerging frameworks signal emerging interest in charging data centers based more closely on grid usage, rather than full nameplate capacity, though minimum charges for backup service could still apply.

    Developer Financial Commitments. Utilities and regulators are requiring upfront security deposits, long-term contracts, and early exit fees to ensure speculative projects do not force infrastructure investments that other ratepayers ultimately bear. These measures aim to protect existing ratepayers from bearing costs of speculative or withdrawn projects, while FERC’s PJM order also creates pathways for developers willing to accept curtailment risk to potentially expedite timelines.

    Co-Location Frameworks. FERC’s PJM order and DOE’s ANOPR signal that co-located generation can be a viable model when structured to protect ratepayers. However, the requirement that generators and co-located loads fund transmission upgrades to maintain service for existing customers means co-location does not eliminate grid-related costs.

    Federal-State Jurisdictional Tensions. The DOE ANOPR and Tri-State’s rejected tariff filing at FERC highlight ongoing tensions between federal and state authority. FERC’s own statement in the Tri-State rejection regarding the limits of its authority, combined with NARUC’s opposition to the ANOPR, suggests that any expansion of federal jurisdiction will be contested.

    Interconnection Timelines. Despite efforts to clarify rules, physical interconnection timelines (driven by studies, network upgrade design, and construction) remain lengthy (currently estimated at anywhere from 24 to 48 months).

    Considerations for Colorado Stakeholders

    Companies considering data center investments in Colorado may wish to consider the following:

    • Xcel’s large-load tariff filing will establish initial service terms, cost allocation, and co-location treatment for the state’s largest utility. Interested stakeholders should review the filing (Docket No. 24A-0442E).
    • Early engagement with Xcel, Tri-State, or other serving utilities during site selection can provide clarity on capacity availability, interconnection study timelines, and how emerging tariff frameworks may affect project economics.
    • With regulatory clarity increasing and cost allocation frameworks becoming more defined, co-located generation should be evaluated. However, financial models should account for network upgrade obligations that may be required when generators “leave the grid.”
    • Stakeholders may wish to monitor FERC Docket No. RM26-4-000 and consider filing comments to ensure any federal framework accommodates Colorado’s regulatory structures, particularly given ongoing jurisdictional contests and active comment proceedings. Additionally, monitoring PJM’s January 19, 2026 report to FERC and subsequent tariff implementation may provide insights into frameworks that could be adopted in other regions.
    • Power supply strategy – whether traditional utility service, co-located generation, hybrid models, or acceptance of curtailment risk through non-firm arrangements – should be determined early and integrated with cooling design, air permitting, water rights strategy, and land use review.

    The convergence of federal action by DOE and FERC, Colorado PUC directives, and Tri-State’s jurisdictional challenges creates a dynamic regulatory environment for data centers and large loads in Colorado. While some clarity is emerging, significant questions remain regarding implementation, cost allocation details, and the interplay between federal and state authority.

    Corrections & Amplifications

    The Colorado PUC issued Decision No. C25-0747 on November 6, 2025, adopting guiding principles for large-load service and directing Xcel Energy to file its large-load tariff proposal by January 31, 2026 (original deadline). An earlier version of this article referred to the decision as occurring in “late October 2025” with a December 2025 written decision and described the filing deadline vaguely as “January 2026.” Xcel requested an extension to April 2, 2026 via variance petition filed January 26, 2026. (Corrected February 19, 2026)

    For questions about energy regulatory developments impacting data centers, please contact RJ Colwell.

    Caroline Schorsch

    January 9, 2026
    Legal Alerts
  • What Is Changing in 2026 for Colorado Licensed Investment Advisers and for Colorado Licensed Investment Adviser Representatives?

    Effective January 14, 2026, the Colorado Division of Securities has adopted amendments to its rules under the Colorado Securities Act, including certain rules (the “Colorado Rules”) affecting Colorado licensed investment advisers and Colorado Licensed Investment Adviser Representatives (“IARs”). These amendments will affect how individuals can qualify to serve as an IAR and the ability of such IARs to keep exam results “alive” while out of the industry. These amendments are consistent with those adopted in 2023 by the North American Securities Administrators Association(“NASAA”), which, among other things, promulgates model statutes, rules, and regulations that seek to maintain consistency among the states.

    What Changed?

    • In light of the Investment Adviser Association no longer offering the Chartered Investment Counselor (“CIC”) designation, Colorado has removed the CIC designation from the list of credentials that can be used in lieu of the examination requirement to qualify as an IAR. Any individual who is currently licensed in Colorado as an IAR will not be affected by the removal of the designation so long as such license remains in effect. Any individual who is not licensed in the state and intends to rely on their CIC designation should instead consider relying on their designation as a Chartered Financial Analyst (“CFA”) granted by the Association for Investment Management and Research, since all CIC holders must also be a CFA. Alternatively, individuals can consider other recognized pathways to be properly licensed as an IAR in the state of Colorado, such as by obtaining a satisfactory score on the Series 65 exam, the Series 66 plus Series 7 exams, or by holding a different eligible credential, such as a Chartered Financial Consultant (“ChFC”) certification granted by The American College.
    • Colorado also adopted NASAA’s Investment Adviser Representative Exam Validity Extension Program (the “Program”). Under the Program, so long as an individual meets the specified criteria described below, any person who terminates their IAR license may nevertheless maintain the validity of their Series 65 exam or the IAR portion of the Series 66 exam despite no longer being employed or associated with an investment adviser or federal covered investment adviser for up to five (5) years following their termination.[1] In order to rely on this new rule, the IAR must:
    • Have previously taken and successfully passed the examination for which they seek to rely on for the purposes of licensure;
    • Have previously been licensed as an IAR for at least one (1) year immediately preceding the termination of their IAR license;
    • Not be subjected to statutory disqualification under Section 3(a)(39) of the Securities Exchange Act of 1934 while licensed as an IAR or at any period after termination of the license;
    • Elect to participate in the Program within two (2) years from the effective date of the termination of the IAR license;
    • Be compliant with, and not have a deficiency under, the IAR continuing education program under Colorado Rule 51-4.4.1(IA) at the time the IAR license becomes ineffective; and
    • Complete on an annual basis on or before December 31 of each year in which the IAR is relying on the Program:
      • Six (6) Credits of IAR Continuing Education (“CE”) Ethics and Professional Responsibility Content offered by an Authorized Provider as defined in Colorado Rule 51-4.4.1(IA)(J)(2), including at least three (3) hours covering the topic of ethics, and
      • Six (6) Credits of IAR CE Products and Practice Content offered by an Authorized Provider as defined in Rule 51-4.4.1(IA)(J)(2).

    Anyone who elects to participate in the Program must complete the credits specified in paragraph (6) above for each calendar year after their IAR license becomes ineffective, regardless of when they elect to participate in the Program. However, individuals who comply with the Financial Industry Regulatory Authority (“FINRA”) Maintaining Qualification Program under FINRA Rule 1240(c) will be considered in compliance with paragraph (6) above as well.

    Key Takeaways for Colorado Licensed Investment Advisers and Licensed IARs

    • If you engage an individual with prior industry experience, consider adding to your intake process a method for determining whether they were relying on the Program for the basis of a non-expired license. In these instances, seeking documentation to confirm Program compliance by reviewing records maintained by that individual while a part of the Program as well as other third-party sources, principally as it relates to statutory disqualification and continuing education, would be advised.
    • If you are an individual leaving the industry and intending to return within five (5) years, evaluate the positive and negative ramifications of enrolling in the Program. If you decide to enroll, pay close attention to the required continuing education requirements to remain in compliance with the Program and to remain eligible to once again become a fully licensed IAR without having to sit for examinations or otherwise seek exemptive relief.

    For additional guidance or support, please reach out to a member of our Asset Management Group or another member of the Davis Graham Team.


    [1] 3 CCR 704-1-51-4.4.2(IA).

    Caroline Schorsch

    January 7, 2026
    Legal Alerts
  • What is CIPA and Why is My Company Being Accused of “Wiretapping” on Our Own Website? 

    Consumer-facing businesses across the U.S. are seeing a surge in demand letters alleging that common website technologies, such as session replay software, chatbots, and pixel trackers, violate decades-old state wiretapping laws, most notably the California Invasion of Privacy Act (CIPA). These letters are often styled to resemble formal complaints and typically follow a similar playbook: they allege that a California resident visited the company’s website, entered information or messages (often through a search bar, form, or chat feature), and that those communications were intercepted in real time by embedded third-party tools without the user’s prior consent.

    This client alert explains why these letters are becoming more common, what they typically allege, and practical steps companies can take to help reduce exposure.

    What is CIPA?

    CIPA is a California statute that was enacted in 1967 amid growing concerns of eavesdropping amid the advancement of wiretapping technology in the 1960s. The law regulates the interception, eavesdropping, and recording of certain communications.

    In the context of privacy litigation, CIPA claims most commonly focus on Section 631(a), although plaintiffs have also relied on Sections 632 and 638.51(a) in some complaints. Section 631(a) generally prohibits intentionally intercepting communications while in transit without the consent of all parties to the communication. Section 632 separately regulates the recording or eavesdropping of confidential communications without the consent of all parties. Section 638.51(a) prohibits the use of a pen register without prior consent.

    CIPA provides a private right of action with statutory damages of $5,000 per violation or three times actual damages, whichever is greater, and does not require proof of actual harm. This is the key reason CIPA has become an attractive vehicle for plaintiffs. The availability of statutory damages also distinguishes CIPA from more modern consumer privacy regimes, such as the California Consumer Privacy Act (CCPA), the Colorado Privacy Act (CPA), and other recently enacted state privacy laws, which generally do not provide private statutory damages for similar claims.

    Critically, courts have held that companies located outside California may still face potential CIPA exposure where the affected website user is located in California. As a result, use of third-party tracking tools on a website accessible to California residents can potentially implicate CIPA, even if the company has no physical presence or targeted operations in the state.

    How does CIPA apply to website tracking technologies?

    There is no uniform consensus on how CIPA applies to modern web tracking. Although many CIPA claims are dismissed at the pleading stage or on summary judgment, a meaningful number have survived early challenges.

    A central issue is what qualifies as the “contents” of a communication. Several courts have allowed claims to proceed where the alleged collection captures the substance or meaning of a communication, rather than only technical data. In Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073 (C.D. Cal. 2021), for example, the court rejected the argument that keystroke data, IP address, and browser data constituted message content. By contrast, in St. Aubin v. Carbon Health Techs., Inc., No. 4:24-cv-00667 (N.D. Cal. Oct. 1, 2024), the court denied a motion to dismiss and held that descriptive URLs may qualify as content where they reveal specific information about a user’s queries.

    Courts also scrutinize vendor roles, with higher risk where a vendor can use or monetize data for its own purposes. In Javier v. Assurance IQ, LLC, 2022 WL 1744107 (9th Cir. May 31, 2022), for example, the court found a vendor could qualify as a third-party eavesdropper if it had the capacity to use collected data for its own benefit. By contrast, in Graham v. Noom, Inc., 533 F. Supp. 3d 823 (N.D. Cal. 2021), the court dismissed a CIPA claim, holding that the defendant’s session replay vendor did not qualify as a third-party eavesdropper where it collected data solely on the defendant’s behalf and was contractually restricted from using the data for its own independent purposes. The court reasoned the vendor’s use of the data was comparable to that of a tape recorder and therefore its conduct did not give rise to liability under the law.

    Practical steps to help reduce risk

    Effective risk management starts with operational reality. To help mitigate risk under CIPA and similar state wiretapping laws, companies should consider the following steps:

    • Audit website tracking technologies. Identify which third-party tools run on the company’s websites, when and how they activate, what data they collect, and where that data is transmitted. The audit should pay close attention to chat features, search bars, forms, and session replay tools. The company should also consider eliminating any tools that provide more risk than value.
    • Review and validate consent mechanisms. Cookie banners and consent tools can help mitigate risk, but only if they accurately reflect how tracking technologies actually function. Companies should confirm that banner language, consent options, and technical implementation are aligned in practice. For example, where a banner suggests that tracking will not occur if a user declines, but tracking continues anyway, that mismatch can undermine consent-based defenses and create exposure not only under CIPA, but also under the FTC Act and similar state consumer protection laws.
    • Update privacy policies and related disclosures. Privacy policies and related disclosures should accurately describe tracking practices, the categories of data collected, and the role of third-party vendors. Inconsistencies between public disclosures and actual technical behavior are frequently highlighted in demand letters and complaints.
    • Manage vendor risk. Companies should evaluate whether vendors are acting as service providers or have the ability to use or monetize data for their own purposes. Vendor agreements should, where appropriate, restrict secondary data use, limit retention, require compliance with applicable privacy laws, and include contractual protections tailored to the company’s risk profile.
    • Coordinate CIPA posture with broader privacy compliance. Obligations under the Colorado Privacy Act and similar state laws, particularly around consent, opt-out mechanisms, and transparency, can affect CIPA risk. Companies should assess how global privacy controls, consent signals, and opt-out frameworks operate across jurisdictions and whether those mechanisms are consistently honored in practice.
    • Document technical and compliance decisions. Maintaining clear documentation of audits, vendor roles, and implementation decisions can be critical when responding to demand letters or assessing litigation risk.

    Many CIPA demand letters appear to be part of a volume-driven strategy that leverages statutory damages, unsettled case law, and confusion about how consent mechanisms and tracking technologies operate in practice to pressure companies into early settlements. Companies that clearly understand the tools deployed on their websites and align consent mechanisms with actual technical behavior will be better positioned to evaluate the merits of these claims and make informed decisions about next steps.

    For questions about the California Invasion of Privacy Act or other data privacy topics, please contact Alex Paalborg or a member of the Davis Graham IP & Technology Transactions Group.

    Caroline Schorsch

    December 16, 2025
    Legal Alerts
    CIPA, CPA, privacy, privacy consent
  • Colorado Supreme Court Clarifies Anti-SLAPP “Public Issue” Standard: Two-Step Test, Motive Irrelevant 

    On Monday, in Lind-Barnett v. Tender Care Veterinary Center Inc., 2025 CO 62, the Colorado Supreme Court announced a two-step test for determining whether challenged speech or conduct is made “in connection with a public issue or an issue of public interest” under Colorado’s anti-SLAPP statute. Courts must first assess whether the activity could reasonably be understood to relate to a public issue; then they must determine whether the activity contributed to public discussion or debate about that issue. The speaker’s motive plays no role in either inquiry. 

    The dispute arose after two community members—one identifying herself as a long-time breeder, trainer, sitter, and caregiver—posted a series of negative, widely viewed Facebook reviews criticizing a veterinary clinic’s quality of care and business practices, including alleged misdiagnoses and retaliatory conduct. The posts, shared on multiple local community pages, generated dozens of reactions and over 140 comments, which included accounts of other people’s experiences and statements that the information “may save lives.” When the posters refused to remove their content, the clinic sued for defamation. 

    The defendants moved to dismiss under Colorado’s anti-SLAPP statute, invoking the catchall provision that protects conduct or communication in furtherance of free speech or petition “in connection with a public issue or an issue of public interest.” § 13-20-1101(2)(a)(IV), C.R.S. (2025). The district court and the court of appeals denied the motion, concluding the posts were primarily private grievances that did not contribute to broader public discourse. 

    The Supreme Court reversed, holding the division applied the wrong legal standard, and set forth the two-step analysis courts must apply when determining whether challenged speech is made “in connection with a public issue or an issue of public interest.” 

    First, courts must ask whether an objective observer “could reasonably understand that the speech or conduct, considered in light of its content and context, is made in connection with a public issue or issue of public interest, even if it also implicates a private dispute.” While declining to define the full scope of “public issue” or “public interest,” the Court identified three nonexhaustive categories that often qualify: (1) statements that concern a person or entity in the public eye; (2) conduct that could directly affect a large number of people beyond the direct participants; and (3) topics of widespread, public interest. 

    Second, courts must examine the relationship between the speech and the identified public issue to determine “whether the challenged activity contributed to public discussion or debate regarding that issue.” In this step, courts should consider factors such as audience, speaker, location, purpose, and timing. 

    Crucially, the Court emphasized that a speaker’s motive is not relevant to either step of the anti-SLAPP analysis. The Court criticized the division’s reliance on motive—specifically, the defendants’ supposed desire “to exact some revenge”—in concluding the posts did not contribute to a broader public discussion about pet health care. At the same time, the Court recognized that while motive cannot be used to constrict the anti-SLAPP statute’s threshold protection, it may become relevant at a later stage—after the defendant establishes that the conduct is protected and the burden shifts to the plaintiff to show a likelihood of success on the claim, such as in defamation claims requiring proof of actual malice. 

    Applying these principles, the Court agreed with the division that consumer information about veterinary services implicates a public issue given, the societal interest in animal welfare. It held that the division erred by discounting the anti-SLAPP protections based on the defendants’ perceived retaliatory intent and by treating the speakers’ private grievances as dispositive of the public-interest inquiry. The Court held the broader context—the speaker’s personal experiences and use of community forums, the sizeable local audience, the high level of engagement, and the posts’ focus on the quality and practices of a licensed veterinary facility—supports the conclusion that the posts reasonably implicated and contributed to public discussion on matters of public interest. 

    The Supreme Court reversed the division’s judgment and remanded the case for the trial court to apply the clarified two-step test. 

    Caroline Schorsch

    December 10, 2025
    Legal Alerts
  • A Foster Home for Orphaned Wells? States Explore Geothermal Energy Generation on Existing Oil & Gas Infrastructure

    Recent years have seen an explosion of interest in “deep” geothermal development – projects targeting energy extracted from heat sources hundreds of meters below the surface and available 24/7 as a baseload power source. As geothermal innovators seek to prove viability of their technologies and heat resources, driving down the per megawatt cost to be comparable to existing energy sources, legislatures in North Dakota and New Mexico have stepped in this year to encourage the use of existing infrastructure and know-how from the oil and gas sector for geothermal energy development.

    This past March, New Mexico enacted House Bill 361, known as the “Well Repurposing Act”, which permits the New Mexico Energy, Minerals, and Natural Resources Department to convert oil and gas wells for geothermal energy and carbon storage purposes and authorizes the Department to establish financial assistance requirements for operators undertaking such conversions.[1] The bill’s sponsors specifically targeted New Mexico’s nearly 2,000 orphaned wells (unplugged oil and gas wells which have no responsible owner or operator) – identifying the potential for geothermal energy producers to leverage existing, drilled wells, while mitigating the public’s exposure to environmental risks and plugging liabilities such orphaned wells pose.[2]

    Meanwhile, North Dakota passed Senate Bill 2360 in April 2025, pursuant to which the legislative management shall consider a feasibility study to evaluate the state’s potential for geothermal energy production, including the potential application of geothermal energy to nonproductive oil and gas wells.[3] Prairie Public Broadcasting later reported that the University of North Dakota’s Energy and Environmental Research Center has been engaged to study the possibility of generating up to 600 megawatts of power from geothermal energy coupled with oil production or CO2 storage.[4]

    Proponents of co-locating geothermal and hydrocarbon production see potential synergies in leveraging the deep expertise in subsurface drilling developed for oil and gas industries to better access and produce from deeper – and hotter – energy sources. All while reducing drilling costs to make geothermal power economically competitive compared to both traditional and renewable energy sources. Meanwhile, legislatures are hoping these solutions can alleviate their states’ concerns regarding orphaned well liabilities while pushing the energy transition forward.


    [1] New Mexico House Bill 361

    [2] New Mexico House Democrats, “House Passes Environmental Protection and Clean Energy Bills”, March 14, 2025

    [3]: North Dakota Senate Bill 2360

    [4] Dave Thompson, “EERC to undertake a study of geothermal energy (audio)”, Prairie Public Broadcasting, July 2, 2025

    Caroline Schorsch

    December 4, 2025
    Legal Alerts
  • The Trump Administration’s Progress to Site Data Centers on Federal Lands: Initial Steps but Work Remains

    In July 2025, President Trump issued an executive order setting forth a presidential priority “to facilitate the rapid and efficient buildout” of data centers and associated infrastructure, including power generation sources and associated transmission lines. To further this goal, the order directs the utilization of “federally owned land and resources for the expeditious and orderly development of data centers.” Additionally, the order calls for the identification of Brownfield and Superfund sites for data center development.

    Federal agencies’ implementation of these directives to date is mixed. The Department of Energy (DOE) and U.S. Air Force are already accepting proposals for projects at certain sites within their jurisdiction. Despite its vast land holdings, however, the Department of the Interior (DOI) has not yet identified any sites on public lands for data center development. Agencies’ progress is detailed below, with an analysis of the potential impacts of delays.

    Overview of the Executive Order.

    The executive order applies to “data center projects” that require more than 100 megawatts of new load dedicated to artificial intelligence (AI) and certain “components” of these projects—namely, the materials, products, and infrastructure necessary to build data center projects, including energy infrastructure, transmission, and natural gas, coal, nuclear, and geothermal power sources. To be considered a “qualifying project” under the order, a data center project or its components must involve commitments of at least $500 million in capital expenditures, incrementally add more than 100 megawatts of electric load, protect national security, or otherwise be designated a qualifying project by one of several federal agencies.

    Relevant to this update, the order calls for the Department of Defense (now known as the Department of War) (DoD), DOE, and DOI to identify sites for projects on lands within their jurisdiction. Additionally, the order directs the Environmental Protection Agency (EPA) to identify Brownfield sites and Superfund sites suitable for the development of qualifying data center projects.

    Finally, the order sets forth numerous paths to streamline federal agencies’ permitting of data center projects.

    Although Federal Lands Are Targeted for Data Center Projects, No Sites Have Been Identified on Public Lands.

    DOE and DoD are implementing the order’s directive to identify sites for data center projects, but DOI has not yet publicly taken any steps to implement the order to promote the development of data center projects on federal public lands.

    DOE Lands. The day after the President issued the order, DOE announced it had selected four sites—the Idaho National Laboratory, Oak Ridge Reservation in Tennessee, Paducah Gaseous Diffusion Plant in Kentucky, and the Savannah River Site in South Carolina—for data center development and energy generation projects. Then, in the fall of 2025, offices within DOE issued requests for application or proposal for projects at three of these sites; the National Nuclear Security Administration issued a request for offer for a project at the Paducah Gaseous Diffusion Plant. These application periods are either open or have recently closed. DOE has not identified a timeframe as to when it will announce which projects it will select.

    DoD Lands. In October 2025, the U.S. Air Force issued a solicitation for proposals to develop “underutilized” lands at Arnold Air Force Base in Tennessee, Edwards Air Force Base in California, Joint Base McGuire-Dix-Lakehurst in New Jersey, Davis-Monthan Air Force Base in Arizona, and Robins Air Force Base in Georgia. Offers were due on November 14, 2025. The Air Force has not indicated when it will make decisions on proposals.

    DOI Lands. DOI has not identified any sites for data center projects or sought public input on potential sites on federal public lands. Federal public lands include the vast expanse of lands the Bureau of Land Management (BLM) manages in western states for multiple uses, including energy development.

    DOI’s inaction is notable for several reasons. First, the agency is the nation’s largest landholder; DOI manages more than 530 million acres of onshore surface lands and, of these, BLM manages approximately 245 million acres. Second, presidential administrations historically have used public lands to advance national objectives; for example, President Biden relied on public lands to increase large-scale renewable energy production. Finally, because many BLM lands can also be used for energy production, data centers can be co-located with energy sources.

    And, timing compounds DOI’s inaction to date. BLM may be unable to move as nimbly as other federal agencies to authorize data center projects. BLM manages its lands in accordance with resource management plans, which are often developed through a multi-year public process. To accommodate data center development, BLM may need to amend or revise governing plans. Thus, data center development on BLM lands may require more process, and thus more time, than lands managed by other federal agencies.

    Action on Brownfield Sites and Superfund Sites Is Forthcoming.

    EPA has not yet identified Brownfield and Superfund sites for data center projects covered by the order. In November 2025, Inside EPA reported that EPA is developing criteria to identify suitable data center sites.

    The order also calls for EPA, within 180 days of the order (i.e., by January 19, 2026), to develop guidance to expedite environmental reviews for qualified reuse of Brownfield and Superfund sites and to assist state governments and private parties to expeditiously return these sites to productive use. Presumably, this guidance will follow in a timely manner.

    Conclusion

    Much work remains before federal agencies can authorize the construction of data center projects on federal lands. 2026 will be a pivotal year for federal agencies to secure agreements for these projects so that they can be timely constructed.

    Caroline Schorsch

    December 4, 2025
    Legal Alerts
1 2 3 … 29
Next Page
3400 Walnut Street, Suite 700, Denver, CO  80205
303.892.9400
Stay Connected

Sign up to receive our newsletter or update your preferences.

© 2026 Davis Graham

  • Privacy Policy
  • Disclaimer
  • Terms of Use
  • Cookie Policy